<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>走进docker | 如是的学习博客</title><meta name="keywords" content="docker"><meta name="author" content="rushiy"><meta name="copyright" content="rushiy"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="什么是容器？容器技术是一种虚拟化的方案。容器虚拟化也就是操作系统级别的虚拟化，只能运行相同或相似内核的操作系统(也就是说一个基于ubuntu的容器能够运行在centos之上)。Docker使用的容器技术依赖于Linux内核的Namespaces和Cgroups，这两个技术就是为了让操作系统资源被区隔成独立区间。 容器依赖Linux内核特性：  Namespaces：命名空间 Controller">
<meta property="og:type" content="article">
<meta property="og:title" content="走进docker">
<meta property="og:url" content="https://rushiy.gitee.io/docker/%E8%B5%B0%E8%BF%9Bdocker/index.html">
<meta property="og:site_name" content="如是的学习博客">
<meta property="og:description" content="什么是容器？容器技术是一种虚拟化的方案。容器虚拟化也就是操作系统级别的虚拟化，只能运行相同或相似内核的操作系统(也就是说一个基于ubuntu的容器能够运行在centos之上)。Docker使用的容器技术依赖于Linux内核的Namespaces和Cgroups，这两个技术就是为了让操作系统资源被区隔成独立区间。 容器依赖Linux内核特性：  Namespaces：命名空间 Controller">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2022-09-22T03:29:34.000Z">
<meta property="article:author" content="rushiy">
<meta property="article:tag" content="docker">
<meta name="twitter:card" content="summary"><link rel="shortcut icon" href="/img/favicon.jpg"><link rel="canonical" href="https://rushiy.gitee.io/docker/%E8%B5%B0%E8%BF%9Bdocker/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.min.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: undefined,
  translate: undefined,
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: undefined,
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isAnchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: '走进docker',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2022-11-19 01:18:40'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 6.3.0"></head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/img/favicon.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="sidebar-site-data site-data is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">28</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">3</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">如是的学习博客</a></span><div id="menus"><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">走进docker</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2022-09-22T03:29:34.000Z" title="发表于 2022-09-22 11:29:34">2022-09-22</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2022-11-18T17:18:40.949Z" title="更新于 2022-11-19 01:18:40">2022-11-19</time></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="走进docker"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"><i class="fa-solid fa-spinner fa-spin"></i></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><h2 id="什么是容器？"><a href="#什么是容器？" class="headerlink" title="什么是容器？"></a>什么是容器？</h2><p>容器技术是一种<code>虚拟化的方案</code>。容器虚拟化也就是<code>操作系统级别的虚拟化</code>，<code>只能运行相同或相似内核的操作系统</code>(也就是说一个基于ubuntu的容器能够运行在centos之上)。Docker使用的容器技术依赖于Linux内核的<code>Namespaces</code>和<code>Cgroups</code>，这两个技术就是为了让操作系统<code>资源被区隔成独立区间</code>。</p>
<p>容器依赖<code>Linux内核特性</code>：</p>
<ul>
<li><code>Namespaces</code>：命名空间</li>
<li><code>Controller groups（cgroups）</code>：控制组</li>
</ul>
<h3 id="NameSpace"><a href="#NameSpace" class="headerlink" title="NameSpace"></a><code>NameSpace</code></h3><p>为确保提供的是<code>轻量级虚拟化服务</code>，Docker使用了<code>NameSpace</code>。<strong>命名空间提供了系统资源的隔离，资源包括进程、网络、文件系统等。</strong></p>
<p>在同一个Namespace下的进程可以<strong>感知彼此的变化</strong>，而对其他的<code>Namespace</code>一无所知。让容器置身于独立的系统环境中。</p>
<p>Namespace的种类 ：</p>
<ul>
<li>PID（Process ID） ：进程隔离</li>
<li>NET（Network） ：管理网络接口</li>
<li>IPC（InterProcess Communication） ：管理跨进程通信的访问</li>
<li>MNT（Mount） ：管理挂载点</li>
<li>UTS（Unix Timesharing System） ：隔离内核和版本标识</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ll  /proc/$$/ns   <span class="comment"># $$表示当前进程的id，即1，systemd进程</span></span></span><br><span class="line">total 0</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 ipc -&gt; ipc:[4026531839]</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 mnt -&gt; mnt:[4026531840]</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 net -&gt; net:[4026531956]</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 pid -&gt; pid:[4026531836]</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 user -&gt; user:[4026531837]</span><br><span class="line">lrwxrwxrwx 1 root root 0 Mar 31 22:48 uts -&gt; uts:[4026531838]</span><br></pre></td></tr></table></figure>

<h3 id="Controller-groups"><a href="#Controller-groups" class="headerlink" title="Controller groups"></a><code>Controller groups</code></h3><p><code>cgroups是一种Linux提供用于限制、控制、管理资源的机制</code>，所有的任务就是运行在系统中的一个进程，而<code>Cgroups</code>以某种标准将一组进程为目标进行资源分配和控制，例如cpu、内存、带宽等，并且可以动态配置。</p>
<p><code>cgroups</code>的主要功能：</p>
<ul>
<li><strong>资源限制</strong>(Resource limitation)：可以为进程组设定资源使用上限。</li>
<li><strong>优先级设定</strong>(Prioritization)：哪些进程组使用更多的资源，可以为进程组分配特定的CPU、磁盘IO吞吐量等。</li>
<li><strong>资源计量</strong>(Accounting)：记录进程组使用资源的数量–统计。</li>
<li><strong>进程组控制</strong>(Control)：能够将进程组挂起和恢复。</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ll  /sys/fs/cgroup/   <span class="comment"># cgroup执行的资源限制</span></span></span><br><span class="line">total 0</span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 blkio     # 对块设备的io进行限制</span><br><span class="line">lrwxrwxrwx 1 root root 11 Apr  1 10:59 cpu -&gt; cpu,cpuacct   # 限制cpu时间片的分配，与cpuacct挂载同一目录</span><br><span class="line">lrwxrwxrwx 1 root root 11 Apr  1 10:59 cpuacct -&gt; cpu,cpuacct   </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">生产cgroup中的任务占用cpu资源的报告，与cpu挂载同一目录</span></span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 cpu,cpuacct   </span><br><span class="line">drwxr-xr-x 2 root root  0 Apr  1 10:59 cpuset    # 给cgroup的任务分配独立的cpu和内存节点</span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 devices   # 允许或者拒绝cgroup中的任务访问设备</span><br><span class="line">drwxr-xr-x 2 root root  0 Apr  1 10:59 freezer   # 暂停/恢复cgroup中的任务</span><br><span class="line">drwxr-xr-x 2 root root  0 Apr  1 10:59 hugetlb   # 限制使用的内存页数量</span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 memory    # 对cgroup中任务的可用内存进行限制，并自动生产资源占用报告</span><br><span class="line">lrwxrwxrwx 1 root root 16 Apr  1 10:59 net_cls -&gt; net_cls,net_prio   # 使用等级识别符(classid)标记网络数据包，这让Linux流量控制程序(tc)可以识别来自特定从cgroup任务的数据包，并进行网络限制</span><br><span class="line">drwxr-xr-x 2 root root  0 Apr  1 10:59 net_cls,net_prio  </span><br><span class="line">lrwxrwxrwx 1 root root 16 Apr  1 10:59 net_prio -&gt; net_cls,net_prio  # 允许基于cgroup设置网络流量的优先级</span><br><span class="line">drwxr-xr-x 2 root root  0 Apr  1 10:59 perf_event   # 运行使用perf工具来监控cgroup</span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 pids    # 限制任务的数量</span><br><span class="line">drwxr-xr-x 4 root root  0 Apr  1 10:59 systemd</span><br></pre></td></tr></table></figure>

<p>容器实际资源限制文件路径：<code>/sys/fs/cgroup/&lt;资源名&gt;/docker/&lt;容器id&gt;</code></p>
<p><code>cgroup</code>为每个容器都创建了相应的限制目录，<strong>直接修改容器目录中的资源限制类型就能达到限制容器使用资源的目标</strong></p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span></span> </span><br><span class="line">CONTAINER ID   IMAGE  COMMAND                  CREATED        STATUS              PORTS     NAMES</span><br><span class="line">dc6d2297d670   nginx  &quot;/docker-entrypoint.…&quot;   15 hours ago   Up About a minute   80/tcp vibrant_hawking</span><br><span class="line">60ffca766bde   f1cb7c7d58b7   &quot;bash&quot;                   6 weeks ago    Up About a minute             c1</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">cpu目录下的资源限制文件，跟/sys/fs/cgroup/cpu/下的内容大同小异</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">ls</span> /sys/fs/cgroup/cpu/docker/   <span class="comment"># 下面的dc6d2297d670和60ffca766bde就是正在运行的两个容器</span></span></span><br><span class="line">60ffca766bdea3ba772bc8fff9e15a5b569d213d06980f1cb56b0d50a66315cf  cpuacct.usage_percpu  cpu.stat</span><br><span class="line">cgroup.clone_children                                             cpu.cfs_period_us     dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b</span><br><span class="line">cgroup.event_control                                              cpu.cfs_quota_us      notify_on_release</span><br><span class="line">cgroup.procs                                                      cpu.rt_period_us      tasks</span><br><span class="line">cpuacct.stat                                                      cpu.rt_runtime_us</span><br><span class="line">cpuacct.usage                                                     cpu.shares</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">ls</span>   /sys/fs/cgroup/cpu/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/</span></span><br><span class="line">cgroup.clone_children  cgroup.procs  cpuacct.usage         cpu.cfs_period_us  cpu.rt_period_us   cpu.shares  notify_on_release</span><br><span class="line">cgroup.event_control   cpuacct.stat  cpuacct.usage_percpu  cpu.cfs_quota_us   cpu.rt_runtime_us  cpu.stat    tasks</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">cat</span>    /sys/fs/cgroup/cpu/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/tasks</span> </span><br><span class="line">19652    # nginx容器的父进程--master进程</span><br><span class="line">19700    # nginx容器的子进程--worker进程</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ps -ef | grep [1]9652</span></span><br><span class="line">root      19652  19623  0 13:46 ?        00:00:00 nginx: master process nginx -g daemon off;</span><br><span class="line">101       19700  19652  0 13:46 ?        00:00:00 nginx: worker process</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">memory下的资源限制目录，跟/sys/fs/cgroup/memory/下的内容大同小异</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">ls</span>   /sys/fs/cgroup/memory/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/</span></span><br><span class="line">cgroup.clone_children       memory.kmem.max_usage_in_bytes      memory.limit_in_bytes            memory.numa_stat            memory.use_hierarchy</span><br><span class="line">cgroup.event_control        memory.kmem.slabinfo                memory.max_usage_in_bytes        memory.oom_control          notify_on_release</span><br><span class="line">cgroup.procs                memory.kmem.tcp.failcnt             memory.memsw.failcnt             memory.pressure_level       tasks</span><br><span class="line">memory.failcnt              memory.kmem.tcp.limit_in_bytes      memory.memsw.limit_in_bytes      memory.soft_limit_in_bytes</span><br><span class="line">memory.force_empty          memory.kmem.tcp.max_usage_in_bytes  memory.memsw.max_usage_in_bytes  memory.stat</span><br><span class="line">memory.kmem.failcnt         memory.kmem.tcp.usage_in_bytes      memory.memsw.usage_in_bytes      memory.swappiness</span><br><span class="line">memory.kmem.limit_in_bytes  memory.kmem.usage_in_bytes          memory.move_charge_at_immigrate  memory.usage_in_bytes</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">cat</span>    /sys/fs/cgroup/memory/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/tasks</span> </span><br><span class="line">19652    # nginx容器的父进程--master进程</span><br><span class="line">19700    # nginx容器的子进程--worker进程</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ps -ef | grep [1]9652</span></span><br><span class="line">root      19652  19623  0 13:46 ?        00:00:00 nginx: master process nginx -g daemon off;</span><br><span class="line">101       19700  19652  0 13:46 ?        00:00:00 nginx: worker process</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">cat</span>    /sys/fs/cgroup/memory/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/memory.limit_in_bytes</span> </span><br><span class="line">1073741824     # 显示现在分配的内存是1073741824 / 1024 / 1024 /1024 = 1g  </span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker stats dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">查看该容器的资源限制情况，显示内存限制是1G</span></span><br><span class="line">CONTAINER ID   NAME              CPU %     MEM USAGE / LIMIT   MEM %     NET I/O      BLOCK I/O     PIDS</span><br><span class="line">dc6d2297d670   vibrant_hawking   0.00%     2.531MiB / 1GiB     0.25%     1.01kB / 0B  22.3MB / 0B   2</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">修改容器内存限制，需要注意的是，修改的内存值大于限制值时将修改失败，可以改小，不能改大</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">echo</span> <span class="string">&quot;200M&quot;</span> &gt;  /sys/fs/cgroup/memory/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/memory.limit_in_bytes</span>   </span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"><span class="built_in">cat</span>    /sys/fs/cgroup/memory/docker/dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b/memory.limit_in_bytes</span> </span><br><span class="line">209715200    # 209715200 / 1024 / 1024 = 200M</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">修改完成后查看容器内存限制，内存值已经变成了200m</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker stats dc6d2297d670ff91bc2dc1fe0e1f7c38563d6f0279a26e4664d7c87ec96ea86b</span></span><br><span class="line">CONTAINER ID   NAME              CPU %     MEM USAGE / LIMIT   MEM %     NET I/O     BLOCK I/O     PIDS</span><br><span class="line">dc6d2297d670   vibrant_hawking   0.00%     2.531MiB / 200MiB   1.27%     1.01kB / 0B 22.3MB / 0B   2</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>除了直接修改容器下指定文件来修改限制容器使用资源外，还可以通过下面的命令行命令进行修改。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker update --<span class="built_in">help</span>   <span class="comment"># docker资源限制主要是下面的几个类型</span></span></span><br><span class="line"></span><br><span class="line">Usage:  docker update [OPTIONS] CONTAINER [CONTAINER...]</span><br><span class="line"></span><br><span class="line">Update configuration of one or more containers</span><br><span class="line"></span><br><span class="line">Options:</span><br><span class="line">      --blkio-weight uint16        Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)</span><br><span class="line">      --cpu-period int             Limit CPU CFS (Completely Fair Scheduler) period</span><br><span class="line">      --cpu-quota int              Limit CPU CFS (Completely Fair Scheduler) quota</span><br><span class="line">      --cpu-rt-period int          Limit the CPU real-time period in microseconds</span><br><span class="line">      --cpu-rt-runtime int         Limit the CPU real-time runtime in microseconds</span><br><span class="line">  -c, --cpu-shares int             CPU shares (relative weight)</span><br><span class="line">      --cpus decimal               Number of CPUs</span><br><span class="line">      --cpuset-cpus string         CPUs in which to allow execution (0-3, 0,1)</span><br><span class="line">      --cpuset-mems string         MEMs in which to allow execution (0-3, 0,1)</span><br><span class="line">      --kernel-memory bytes        Kernel memory limit</span><br><span class="line">  -m, --memory bytes               Memory limit</span><br><span class="line">      --memory-reservation bytes   Memory soft limit</span><br><span class="line">      --memory-swap bytes          Swap limit equal to memory plus swap: &#x27;-1&#x27; to enable unlimited swap</span><br><span class="line">      --pids-limit int             Tune container pids limit (set -1 for unlimited)</span><br><span class="line">      --restart string             Restart policy to apply when a container exits</span><br></pre></td></tr></table></figure>

<h2 id="虚拟化技术"><a href="#虚拟化技术" class="headerlink" title="虚拟化技术"></a>虚拟化技术</h2><p><code>虚拟化技术是一种计算机资源管理技术，将内存，网络，CPU等资源进行抽象，让硬件透明，目的是让用户合理地使用操作系统资源。</code></p>
<p><strong>容器与虚拟化</strong></p>
<p><img src="/pic/docker-pic/image-20200715143707656.png" alt="image-20200715143707656"></p>
<p> <strong>容器</strong>是应用程序层的抽象，将代码和依赖项打包在一起。<strong>多个容器可以在同一台计算机上运行，并与其他容器共享操作系统内核，每个容器在用户空间中作为隔离的进程运行</strong>。<strong>容器占用的空间少于VM</strong>（容器映像的大小通常为几十MB），可以处理更多的应用程序，并且需要的VM和操作系统更少。</p>
<p><strong>虚拟机（VM）</strong>是将一台服务器转变为多台服务器的物理硬件的抽象。系统管理程序允许多个VM在单台计算机上运行。每个VM都包含<strong>操作系统，应用程序，必要的二进制文件和库的完整副本</strong></p>
<p><strong>虚拟机和容器都有优势和劣势</strong>，如何选择取决于具体的需求，但有些规则可以参考。</p>
<ul>
<li><p>VM非常适合当应用运行时<strong>需要所有OS资源和功能的场景</strong>，如果需要运行多个这样的应该，可以使用VMs。</p>
</li>
<li><p>容器适合在更少的server上运行更多的应用。</p>
</li>
</ul>
<p>服务器好比运输码头：拥有场地和各种设备（服务器硬件资源），服务器虚拟化好比作码头上的仓库：拥有独立的空间堆放各种货物或集装箱(仓库之间完全独立，都拥有独立的应用系统和操作系统）。</p>
<p>Docker比作集装箱：各种货物的打包，将各种应用程序和他们所依赖的运行环境打包成标准的容器,容器之间隔离。Docker有着小巧、迁移部署快速、运行高效等特点，但隔离性比服务器虚拟化差：不同的集装箱属于不同的运行单位（Docker上运行不同的应用实例），相互独立（隔离）。但由同一个库管人员管理（主机操作系统内核），因此通过库管人员可以看到所有集装箱的相关信息（因为共享操作系统内核，因此相关信息会共享）。</p>
<p>服务器虚拟化就好比在码头上（物理主机及虚拟化层），建立了多个独立的“小码头”—仓库（虚拟机）。其拥有完全独立（隔离）的空间，属于不同的客户（虚拟机所有者）。每个仓库有各自的库管人员（当前虚拟机的操作系统内核），无法管理其它仓库。不存在信息共享的情况</p>
<p>因此，我们需要根据不同的应用场景和需求采用不同的方式使用Docker技术或使用服务器虚拟化技术。例如一个典型的Docker应用场景是当主机上的Docker实例属于单一用户的情况下，在保证安全的同时可以充分发挥Docker的技术优势。对于隔离要求较高的环境如混合用户环境，就可以使用服务器虚拟化技术。</p>
<h2 id="Docker简介"><a href="#Docker简介" class="headerlink" title="Docker简介"></a>Docker简介</h2><h3 id="docker介绍"><a href="#docker介绍" class="headerlink" title="docker介绍"></a>docker介绍</h3><p>官网：<a target="_blank" rel="noopener" href="https://www.docker.com/">https://www.docker.com/</a></p>
<p>官网文档：<a target="_blank" rel="noopener" href="https://docs.docker.com/">https://docs.docker.com/</a></p>
<p><code>docker</code>是<code>PaaS</code>提供商<code>dotCloud</code>开源的一个基于<code>LXC</code>的高级容器引擎，源代码托管在<code>Github</code>上，基于<code>Go 语言</code>并遵从<code>Apache2.0</code>协议开源，<code>docker</code>是容器的一个管理工具，并不是容器。</p>
<p><code>docker</code>可以让开发者打包他们的应用以及依赖包到一个轻量级、可移植的容器中，然后发布到任何流行的<code>Linux</code>机器上，也可以实现虚拟化。容器是完全使用沙箱机制（沙箱就是一个限制应用程序对系统资源的访问的运行环境），相互之间不会有任何接口（类似 iPhone的app）,更重要的是容器性能开销极低。</p>
<p>docker从17.03版本之后分为<code>CE</code>（Community Edition: 社区版）和<code>EE</code>（Enterprise Edition: 企业版）。</p>
<p>Docker自2013年以来非常火热，无论是从<code>github</code>上的代码活跃度，还是<code>Redhat</code>在RHEL6.5中集成对Docker的支持, 就连Google的Compute Engine也支持docker在其之上运行。</p>
<p><strong>docker发展的历史背景：</strong></p>
<ul>
<li><p><strong>环境管理复杂</strong> - 从各种OS到各种中间件到各种app, 一款产品能够成功作为开发者需要关心的东西太多，且难于管理，这个问题几乎在所有现代IT相关行业都需要面对。</p>
</li>
<li><p><strong>云计算时代的到来</strong> - AWS的成功, 引导开发者将应用转移到 cloud 上, 解决了硬件管理的问题，然而中间件相关的问题依然存在 (所以openstack HEAT和 AWS cloudformation 都着力解决这个问题)。开发者思路变化提供了可能性。</p>
</li>
<li><p><strong>虚拟化手段的变化</strong> - cloud 时代采用标配硬件来降低成本，采用虚拟化手段来满足用户按需使用的需求以及保证可用性和隔离性。然而无论是KVM还是Xen在 docker 看来,都在浪费资源，因为用户需要的是高效运行环境而非OS, GuestOS既浪费资源又难于管理, 更加轻量级的LXC更加灵活和快速</p>
</li>
<li><p><strong>LXC的移动性</strong> - LXC在 linux 2.6 的 kernel 里就已经存在了，但是其设计之初并非为云计算考虑的，缺少标准化的描述手段和容器的可迁移性，决定其构建出的环境难于迁移和标准化管理(相对于KVM之类image和snapshot的概念)。docker 就在这个问题上做出实质性的革新。这是docker最独特的地方。</p>
</li>
</ul>
<p>面对上述几个问题，docker设想是交付运行环境如同海运，OS如同一个货轮，每一个在OS基础上的软件都如同一个集装箱，用户可以通过标准化手段自由组装运行环境，同时集装箱的内容可以由用户自定义，也可以由专业人员制造。这样，交付一个软件，就是一系列标准化组件的集合的交付，如同乐高积木，用户只需要选择合适的积木组合，并且在最顶端署上自己的名字(最后一个标准化组件是用户的app)。这也就是基于docker的PaaS产品的原型。</p>
<h3 id="Docker-架构"><a href="#Docker-架构" class="headerlink" title="Docker 架构"></a>Docker 架构</h3><p>Docker使用客户端-服务器 (C&#x2F;S) 架构模式，使用远程API来管理和创建Docker容器。Docker容器通过Docker镜像来创建。容器与镜像的关系类似于面向对象编程中的对象与类，可以理解为程序和进程的关系，镜像是静态的，容器是动态的有生命周期的。</p>
<table>
<thead>
<tr>
<th>docker</th>
<th>面向对象</th>
</tr>
</thead>
<tbody><tr>
<td>容器</td>
<td>对象</td>
</tr>
<tr>
<td>镜像</td>
<td>类</td>
</tr>
</tbody></table>
<img src="/pic/docker-pic/clip_image002.png" alt="img" style="zoom:67%;" />

<center>架构图一</center>

<p>Docker采用C&#x2F;S架构，<code>Docker daemon</code> 作为服务端接受来自客户的请求，并处理这些请求（创建、运行、分发容器）。 客户端和服务端既可以运行在一个机器上，也可通过 socket 或者RESTful API 来进行通信。</p>
<p> <code>Docker daemon</code>一般在宿主主机后台运行，等待接收来自客户端的消息。 Docker 客户端则为用户提供一系列可执行命令，用户用这些命令实现跟<code>Docker daemon</code>交互。</p>
<img src="/pic/docker-pic/image-20200717170409141.png" alt="image-20200717170409141" style="zoom:67%;" />

<center>架构图二</center>

<p>不难发现，docker由内到外是docker daemon（守护进程），docker client（客户端），container（容器），image（镜像），network（网络），data volumes（数据卷）</p>
<p><strong>Docker的基本组成有：</strong></p>
<ul>
<li>Docker Client：客户端，Docker客户端通过命令行或者其他工具使用Docker SDK与Docker的守护进程通信</li>
<li>Docker Daemon：守护进程，</li>
<li>Docker Image：镜像，Docker镜像是用于创建Docker容器的模板。</li>
<li>Docker Container：容器，容器是独立运行的一个或一组应用</li>
<li>Docker Registry：仓库，Docker仓库用来保存镜像，可以理解为代码控制中的代码仓库。  Docker Hub(<a target="_blank" rel="noopener" href="https://hub.docker.com/">https://hub.docker.com</a>) 提供了庞大的镜像集合供使用。用户可创建自己的私有仓库。默认使用https协议进行访问。  拥有两层功能，提供镜像存储的仓库，提供用户获取镜像时的认证</li>
<li>Docker Host：docker运行的主机，一个物理或者虚拟的机器用于执行Docker守护进程和容器。</li>
<li>Containerd：是一个简单的守护进程，向上给Docker Daemon提供接口，向下通过containerd-shim结合runC管理容器</li>
<li>runC：一个命令行工具，它根据OCI标准来创建和运行容器。</li>
</ul>
<img src="/pic/docker-pic/image-20210401142134762.png" alt="image-20210401142134762" style="zoom:67%;" />

<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ps ajxf   <span class="comment"># 执行结果如下，他们之间的pid存在相互关联的关系</span></span></span><br></pre></td></tr></table></figure>

<p><img src="/pic/docker-pic/image-20210401143510994.png" alt="image-20210401143510994"></p>
<h3 id="docker的优缺点"><a href="#docker的优缺点" class="headerlink" title="docker的优缺点"></a>docker的优缺点</h3><h4 id="docker优点"><a href="#docker优点" class="headerlink" title="docker优点"></a>docker优点</h4><p>Docker 是一个用于开发，交付和运行应用程序的开放平台。Docker 使您能够将应用程序与基础架构分开，从而可以快速交付软件。借助 Docker，您可以与管理应用程序相同的方式来管理基础架构。通过利用 Docker 的方法来快速交付，测试和部署代码，您可以大大减少编写代码和在生产环境中运行代码之间的延迟。</p>
<ul>
<li><p><strong>快速，一致地交付您的应用程序</strong></p>
<ul>
<li>Docker 允许开发人员使用您提供的应用程序或服务的本地容器在标准化环境中工作，从而简化了开发的生命周期。</li>
<li>容器非常适合持续集成和持续交付（CI &#x2F; CD）工作流程，请考虑以下示例方案：<ul>
<li>您的开发人员在本地编写代码，并使用 Docker 容器与同事共享他们的工作。</li>
<li>他们使用 Docker 将其应用程序推送到测试环境中，并执行自动或手动测试。</li>
<li>当开发人员发现错误时，他们可以在开发环境中对其进行修复，然后将其重新部署到测试环境中，以进行测试和验证。</li>
<li>测试完成后，将修补程序推送给生产环境，就像将更新的镜像推送到生产环境一样简单。</li>
</ul>
</li>
</ul>
</li>
<li><p><strong>响应式部署和扩展</strong></p>
<ul>
<li>Docker 是基于容器的平台，允许高度可移植的工作负载。Docker 容器可以在开发人员的本机上，数据中心的物理或虚拟机上，云服务上或混合环境中运行。</li>
<li>Docker 的可移植性和轻量级的特性，还可以使您轻松地完成动态管理的工作负担，并根据业务需求指示，实时扩展或拆除应用程序和服务。</li>
</ul>
</li>
<li><p><strong>在同一硬件上运行更多工作负载</strong></p>
<ul>
<li>Docker 轻巧快速。它为基于虚拟机管理程序的虚拟机提供了可行、经济、高效的替代方案，因此您可以利用更多的计算能力来实现业务目标。Docker 非常适合于高密度环境以及中小型部署，而您可以用更少的资源做更多的事情。</li>
</ul>
</li>
</ul>
<h4 id="docker局限"><a href="#docker局限" class="headerlink" title="docker局限"></a>docker局限</h4><p>Docker并不是全能的，设计之初也不是KVM之类虚拟化手段的替代品，简单总结几点：</p>
<ul>
<li><p>Docker是基于Linux 64bit的，无法在32bit的linux&#x2F;Windows&#x2F;unix环境下使用</p>
</li>
<li><p>LXC是基于cgroup等linux kernel功能的，因此container的guest系统只能是linux base的</p>
</li>
<li><p>隔离性相比KVM之类的虚拟化方案还是有些欠缺，所有container公用一部分的运行库</p>
</li>
<li><p>网络管理相对简单，主要是基于namespace隔离</p>
</li>
<li><p>cgroup的cpu和cpuset提供的cpu功能相比KVM的等虚拟化方案相比难以度量(所以dotcloud主要是按内存收费)</p>
</li>
<li><p>Docker对disk的管理比较有限</p>
</li>
<li><p>container随着用户进程的停止而销毁，container中的log等用户数据不便收集</p>
</li>
</ul>
<p>针对1-2，有windows base应用的需求的基本可以pass了; 3-5主要是看用户的需求，到底是需要一个container还是一个VM, 同时也决定了docker作为 IaaS 不太可行。</p>
<p>针对6,7虽然是docker本身不支持的功能，但是可以通过其他手段解决(disk quota, mount –bind)。总之，选用container还是vm, 就是在隔离性和资源复用性上做权衡。</p>
<p><strong>Docker在本质上是一个附加系统</strong>。使用文件系统的不同层构建一个应用是有可能的。每个组件被添加到之前已经创建的组件之上，可以比作为一个文件系统更明智。分层架构带来另一方面的效率提升，当你重建存在变化的Docker镜像时，不需要重建整个Docker镜像，只需要重建变化的部分。</p>
<p>可能更为重要的是，Docker旨在用于弹性计算。每个Docker实例的运营生命周期有限，实例数量根据需求增减。在一个管理适度的系统中，这些实例生而平等，不再需要时便各自消亡了。</p>
<p>针对Docker环境存在的不足，意味着在开始部署Docker前需要考虑如下几个问题。首先，Docker实例是无状态的。这意味着它们不应该承载任何交易数据，所有数据应该保存在数据库服务器中。</p>
<p>其次，开发Docker实例并不像创建一台虚拟机、添加应用然后克隆那样简单。为成功创建并使用Docker基础设施，管理员需要对系统管理的各个方面有一个全面的理解，包括Linux管理、编排及配置工具比如Puppet、Chef以及Salt。这些工具生来就基于命令行以及脚本。</p>
<h3 id="docker应用场景"><a href="#docker应用场景" class="headerlink" title="docker应用场景"></a>docker应用场景</h3><p>​        在docker的网站上提到了docker的典型场景：</p>
<ul>
<li><p>Automating the packaging and deployment of applications（使应用的打包与部署自动化）</p>
</li>
<li><p>Creation of lightweight, private PAAS environments（创建轻量、私密的PAAS环境）</p>
</li>
<li><p>Automated testing and continuous integration&#x2F;deployment（实现自动化测试和持续的集成&#x2F;部署）</p>
</li>
<li><p>Deploying and scaling web apps, databases and backend services（部署与扩展webapp、数据库和后台服务）</p>
</li>
</ul>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="https://rushiy.gitee.io">rushiy</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://rushiy.gitee.io/docker/%E8%B5%B0%E8%BF%9Bdocker/">https://rushiy.gitee.io/docker/%E8%B5%B0%E8%BF%9Bdocker/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://rushiy.gitee.io" target="_blank">如是的学习博客</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/docker/">docker</a></div><div class="post_share"><div class="social-share" data-image="" data-sites="wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/butterfly-extsrc/sharejs/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/sharejs/dist/js/social-share.min.js" defer></script></div></div></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="/img/favicon.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">rushiy</div><div class="author-info__description"></div></div><div class="card-info-data site-data is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">28</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">3</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div><div class="card-info-social-icons is-center"><a class="social-icon" href="mailto:rushiy@reg.email.cn" target="_blank" title="Email"><i class="fas fa-envelope"></i></a></div></div><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BB%80%E4%B9%88%E6%98%AF%E5%AE%B9%E5%99%A8%EF%BC%9F"><span class="toc-number">1.</span> <span class="toc-text">什么是容器？</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#NameSpace"><span class="toc-number">1.1.</span> <span class="toc-text">NameSpace</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Controller-groups"><span class="toc-number">1.2.</span> <span class="toc-text">Controller groups</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%99%9A%E6%8B%9F%E5%8C%96%E6%8A%80%E6%9C%AF"><span class="toc-number">2.</span> <span class="toc-text">虚拟化技术</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Docker%E7%AE%80%E4%BB%8B"><span class="toc-number">3.</span> <span class="toc-text">Docker简介</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#docker%E4%BB%8B%E7%BB%8D"><span class="toc-number">3.1.</span> <span class="toc-text">docker介绍</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Docker-%E6%9E%B6%E6%9E%84"><span class="toc-number">3.2.</span> <span class="toc-text">Docker 架构</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#docker%E7%9A%84%E4%BC%98%E7%BC%BA%E7%82%B9"><span class="toc-number">3.3.</span> <span class="toc-text">docker的优缺点</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#docker%E4%BC%98%E7%82%B9"><span class="toc-number">3.3.1.</span> <span class="toc-text">docker优点</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#docker%E5%B1%80%E9%99%90"><span class="toc-number">3.3.2.</span> <span class="toc-text">docker局限</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#docker%E5%BA%94%E7%94%A8%E5%9C%BA%E6%99%AF"><span class="toc-number">3.4.</span> <span class="toc-text">docker应用场景</span></a></li></ol></li></ol></div></div><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E6%A8%A1%E6%9D%BF%E7%B3%BB%E7%BB%9F/" title="Django模板系统"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django模板系统"/></a><div class="content"><a class="title" href="/django/Django%E6%A8%A1%E6%9D%BF%E7%B3%BB%E7%BB%9F/" title="Django模板系统">Django模板系统</a><time datetime="2022-11-04T07:08:03.000Z" title="发表于 2022-11-04 15:08:03">2022-11-04</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E8%A7%86%E5%9B%BE/" title="Django视图"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django视图"/></a><div class="content"><a class="title" href="/django/Django%E8%A7%86%E5%9B%BE/" title="Django视图">Django视图</a><time datetime="2022-11-03T07:07:51.000Z" title="发表于 2022-11-03 15:07:51">2022-11-03</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E8%B7%AF%E7%94%B1%E7%B3%BB%E7%BB%9F/" title="Django路由系统"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django路由系统"/></a><div class="content"><a class="title" href="/django/Django%E8%B7%AF%E7%94%B1%E7%B3%BB%E7%BB%9F/" title="Django路由系统">Django路由系统</a><time datetime="2022-11-02T07:07:34.000Z" title="发表于 2022-11-02 15:07:34">2022-11-02</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/%E8%B5%B0%E8%BF%9BDjango/" title="走进Django"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="走进Django"/></a><div class="content"><a class="title" href="/django/%E8%B5%B0%E8%BF%9BDjango/" title="走进Django">走进Django</a><time datetime="2022-11-01T07:01:20.000Z" title="发表于 2022-11-01 15:01:20">2022-11-01</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/python/python%E5%B8%B8%E7%94%A8%E6%A8%A1%E5%9D%97/" title="python常用模块"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="python常用模块"/></a><div class="content"><a class="title" href="/python/python%E5%B8%B8%E7%94%A8%E6%A8%A1%E5%9D%97/" title="python常用模块">python常用模块</a><time datetime="2022-10-28T15:34:07.000Z" title="发表于 2022-10-28 23:34:07">2022-10-28</time></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">&copy;2022 By rushiy</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.min.js"></script><div class="js-pjax"></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div></body></html>